Embedded Canvas App in Chrome request sign in

[Xun]

So have this embedded canvas app, works in Edge fine. and I don't think it ever asked me to sign in again on the embedded canvas app tab.

However if I load the Customer Service Hub in Chrome, open a case record and click on the tab where the Canvas App is embedde, chrome askes me to sign in again. "For security reasons, we need you to sign in once more." with a sign in button. If I click on the sign in button I could see a popup window flashes briefly then dissappears. but the Canvas App doesn't load at all, no other error messages apart of it is stuck on the "For security reasons, we need you to sign in once more."? 

Is it chrome setting? I have already changed the setting to allow pop-ups, restarted the chrome. But that doesn't do the trick... any ideas?

And whiles I am logged into Customer Service Hub in Chrome, I can open a new tab and load web.powerapps.com fine it doesn't even ask for my credentials.

I am sign into Customer Service Hub as the user who has created the Canvas App, and the same user is used to connects the CDS.

Any suggestions and ideas please?

Regards

Xun

[v-monli-msft]

Hi @Xun ,

How did you embed this app?

Regards,

Mona

[Xun]

Hi @v-monli-msft 

it is embedded as field control on a case form.

Yes it pass the current record as the data context.

Cheers

[v-monli-msft · Accepted solution]

Hi @Xun ,

Have you checked the Location setting in Chrome? This feature is still in preview and isn't available in some countries yet.

Regards,

Mona

[Xun]

Thanks @v-monli-msft 

Interestingly our Chrome Settings - Location is set to Blocked.

And currently I can't even switch it on...

Will have to talk to someone who have rights to change this setting.

Meanwhile Mona, are you saying because the embedded canvas app is in a preview, so the loading of it inside a web browser is relaying on the location that browser could provide? ...

[cherie]

Can you please check if you have third party cookies blocked? If they are, please unblock them and try again.

Thanks

[Xun]

Thanks @cherie 

Yup, just like you expected the setting Block third party cookies is turned on.

I have added the following addresses to be allowed. and restart chrome, but sadly no change of behaviour...

crm11.dynamics.com

powerapps.com

Again this is our current org setting, I can't just turn it off... Is there a list of sites that I could refer our infrastucture team to in order to ensure the embedded powerapp in D365 when using Chrome?

PS everytime I click the signin button, I get the following error in the chrome console

BSSO Telemetry: {"result":"Error","error":"NoExtension","type":"ChromeSsoTelemetry","data":{},"traces":["BrowserSSO Initialized","Creating ChromeBrowserCore provider","Sending message for method CreateProviderAsync","Received message for method CreateProviderAsync","Error: ChromeBrowserCore error NoExtension: Extension is not installed."]}

[cherie · Accepted solution]

@Xun I believe you also need to add login.microsoftonline.com to the list

[Xun]

Hi @cherie 

Many thanks.

after adding login.microsoftonline.com to the allowed list, the error I quote in my last message didn't come up in console.

However I just noticed whether I am in the d365 Org or the web.powerapps.com in chrome, I get a little red dot right next to the address bar. Hover my mouse over it, it reads "this page was prevented from setting cookie".

The excepting list doesn't seem to take effect...

Will have ask our desktop guys and see if you could left the block on chrome...

[Xun]

Futher to my last message, I have done another test.

So I am sign in to my D365 Org, in the same chrome tab I then loaded web.powerapps.com fine (no prompt for signin)

However when I try to edit a canvas app, chrome prompted for "Authentication". But by click the authentiction button it does nothing.

and there is any error message as following ...

Unable to obtain access token for resource 'https://service.powerapps.com/'. Error from ADAL.js: login_required (AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com).
Trace ID: f0bb2f09-e0c4-49cd-9eec-4c948b030e00
Correlation ID: c5eb1526-34bd-48a9-972e-11ccdd2ef12a
Timestamp: 2019-05-21 10:08:43Z).

Wonder what this really meant?